Red Hat Enterprise Linux 10 · Vulnerability
cve-program · CVE-2026-81666
PublishedAn integer overflow was found in Corosync's handling of membership commit token messages. The length-validation check for these messages can be bypassed on 32-bit systems due to an integer overflow in the calculation of the expected message length, allowing a crafted network packet to trigger an out-of-bounds memory access that crashes the Corosync daemon. This results in a denial of service for the affected cluster node. The overflow does not occur on 64-bit systems, where the length calculation is correctly performed in 64-bit arithmetic.
Read the publisher's advisoryAffected versions, risk and source history
Related advisories and sources
Publishers link these advisories through the identifiers shown below. A shared identifier or date alone does not tell you whether your software is affected or whether the advisories describe the same cause.
CVE-2026-81666 · CVE overview and exploitation status
cve-program · CVE-2026-81666
Related changes
Linked by CVE identifier- Corosync: corosync: integer overflow in check_memb_commit_token_sanity may bypass message length validation on 32-bit systems · Affected-version evidence changed · 6 Nov 2026
- Corosync: corosync: integer overflow in check_memb_commit_token_sanity may bypass message length validation on 32-bit systems · Affected-version evidence changed · 3 Nov 2026